Don't like ads? PRO users don't see any ads ;-)
Public Pastes
Guest

Untitled

By: a guest on Jul 10th, 2012  |  syntax: Python  |  size: 3.87 KB  |  hits: 14  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
This paste has a previous version, view the difference. Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1.     def getContext(self):
  2.         ctx = _create_ssl_context(self._key_filename,
  3.                                   self._cert_filename,
  4.                                   self._verify_ca_filename,
  5.                                   self._p12_filename,
  6.                                   self._verify_ca_from_p12,
  7.                                   self._key_pass, self._p12_pass)
  8.  
  9.         if self._verify_ca_from_p12 or self._verify_ca_filename is not None:
  10.             opts = SSL.VERIFY_PEER
  11.             if self._enforce_cert:
  12.                 opts |= SSL.VERIFY_FAIL_IF_NO_PEER_CERT
  13.             ctx.set_verify(opts, self._verify_callback)
  14.  
  15.         return ctx
  16.  
  17.     def _verify_callback(self, connection, x509, errnum, errdepth, ok):
  18.         if not ok:
  19.             log.warning("ssl-context", "Invalid certificate: %s",
  20.                         x509.get_subject())
  21.             return False
  22.         return True
  23.  
  24.  
  25. def _create_ssl_context(key_filename=None,
  26.                         cert_filename=None,
  27.                         verify_ca_filename=None,
  28.                         p12_filename=None,
  29.                         verify_ca_from_p12=False,
  30.                         key_pass=None, p12_pass=None):
  31.  
  32.     ctx = SSL.Context(SSL.SSLv3_METHOD)
  33.  
  34.     if p12_filename is not None:
  35.  
  36.         with open(p12_filename) as f:
  37.             try:
  38.                 p12 = crypto.load_pkcs12(f.read(), p12_pass or "")
  39.             except crypto.Error as e:
  40.                 raise SecurityError("Invalid PKCS12 or passphrase for %s: %s"
  41.                                     % (p12_filename, e), cause=e), \
  42.                       None, sys.exc_info()[2]
  43.  
  44.             ctx.use_certificate(p12.get_certificate())
  45.             ctx.use_privatekey(p12.get_privatekey())
  46.             if verify_ca_from_p12:
  47.                 #FIXME: is there no way to set the chain directly ?
  48.                 with tempfile.NamedTemporaryFile() as f:
  49.                     certs = p12.get_ca_certificates()
  50.                     write_certificates(f, *certs)
  51.                     f.flush()
  52.                     ctx.load_verify_locations(f.name)
  53.  
  54.     elif cert_filename is not None and key_filename is not None:
  55.  
  56.         try:
  57.             with open(cert_filename) as f:
  58.                 ft = crypto.FILETYPE_PEM
  59.                 cert = crypto.load_certificate(ft, f.read())
  60.         except IOError as e:
  61.             raise SecurityError("Certificate file access error for %s: %s"
  62.                                 % (cert_filename, e), cause=e), \
  63.                   None, sys.exc_info()[2]
  64.         except crypto.Error as e:
  65.             raise SecurityError("Invalid certificate %s: %s"
  66.                                 % (cert_filename, e), cause=e), \
  67.                   None, sys.exc_info()[2]
  68.  
  69.         try:
  70.             with open(key_filename) as f:
  71.                 ft = crypto.FILETYPE_PEM
  72.                 key = crypto.load_privatekey(ft, f.read(), key_pass or "")
  73.         except IOError as e:
  74.             raise SecurityError("Private key file error for %s: %s"
  75.                                 % (cert_filename, e), cause=e), \
  76.                   None, sys.exc_info()[2]
  77.         except crypto.Error as e:
  78.             raise SecurityError("Invalid private key or passphrase for %s: %s"
  79.                                 % (key_filename, e), cause=e), \
  80.                   None, sys.exc_info()[2]
  81.  
  82.         ctx.use_certificate(cert)
  83.         ctx.use_privatekey(key)
  84.  
  85.         try:
  86.             ctx.check_privatekey()
  87.         except crypto.Error as e:
  88.             raise SecurityError("Certificate and private key files do not "
  89.                                 "match; certificate: %s; private key: %s"
  90.                                 % (cert_filename, key_filename, ), cause=e), \
  91.                   None, sys.exc_info()[2]
  92.  
  93.     if not verify_ca_from_p12 and verify_ca_filename is not None:
  94.         ctx.load_verify_locations(verify_ca_filename)
  95.  
  96.     return ctx
create a new version of this paste RAW Paste Data